CVE-2025-11519
BaseFortify
Publication date: 2025-10-18
Last updated on: 2025-10-21
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| optimole | optimole_wp | 4.1.1 |
| optimole | optimole_wp | 4.1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Insecure Direct Object Reference (IDOR) in the Optimole WordPress plugin (versions up to 4.1.0). It occurs via the /wp-json/optml/v1/move_image REST API endpoint due to missing validation on a user-controlled key. This flaw allows authenticated attackers with Author-level access or higher to offload media files that do not belong to them, potentially accessing or manipulating other users' media.
How can this vulnerability impact me? :
The vulnerability allows attackers with Author-level access or above to offload media files that belong to other users. This could lead to unauthorized access or manipulation of media content, potentially causing data integrity issues or unauthorized data exposure within the WordPress site.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves monitoring for unauthorized use of the /wp-json/optml/v1/move_image REST API endpoint by authenticated users with Author-level access or higher. You can inspect web server logs for suspicious POST requests to this endpoint. For example, using grep on Apache or Nginx logs: `grep '/wp-json/optml/v1/move_image' /var/log/apache2/access.log` or `grep '/wp-json/optml/v1/move_image' /var/log/nginx/access.log`. Additionally, monitoring WordPress user activity logs for unusual media offloading actions by authors can help detect exploitation attempts. Since the vulnerability requires authentication, checking for anomalous authenticated API calls is key. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Optimole WordPress plugin to version 4.1.1 or later, as this version includes security fixes that address CVE-2025-11519 by improving validation and state management in the REST API handlers. Until the update is applied, restrict Author-level user permissions if possible, and monitor API usage closely. Applying the update will enhance API key validation, error handling, and prevent unauthorized media offloading. [1]